Anti SQL Injection Login Filter

PHP Example :

# # login.htm # <!DOCTYPE html PUBLIC "-//W3C//XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>MyWeb.com Login</title> <meta http-equiv="content-type" content="text/html; charset=iso-8859-1" /> </head> <body> <form method="post" action="verify.php"> <input type="text" name="user" /> <input type="password" name="pass" /> <input type="submit" value="Login" /> </form> </body> </html> # # verify.php # <?php function anti_injection( $user, $pass ) { # We'll first get rid of any special characters using a simple regex statement. # After that, we'll get rid of any SQL command words using a string replacment. $banlist = array ( "insert", "select", "update", "delete", "distinct", "having", "truncate", "replace", "handler", "like", "as", "or", "procedure", "limit", "order by", "group by", "asc", "desc" ); if ( eregi ( "[a-zA-Z0-9]+", $user ) ) { $user = trim ( str_replace ( $banlist, '', strtolower ( $user ) ) ); } else { $user = NULL; } # Now to make sure the given password is an alphanumerical string # devoid of any special characters. strtolower() is being used # because unfortunately, str_ireplace() only works with PHP5. if ( eregi ( "[a-zA-Z0-9]+", $pass ) ) { $pass = trim ( str_replace ( $banlist, '', strtolower ( $pass ) ) ); } else { $pass = NULL; } # Now to make an array so we can dump these variables into the SQL query. # If either user or pass is NULL (because of inclusion of illegal characters), # the whole script will stop dead in its tracks. $array = array ( 'user' => $user, 'pass' => $pass ); if ( in_array ( NULL, $array ) ) { die ( 'Hacking attempt. Go play someplace else, you script kiddie.' ); } else { return $array; } } # Now to filter the login data through the Anti-Injection Attack function # and assign the results to an array. The values used are assuming the # login form itself is using the POST method, and the username and # password fields were given the names of "user" and "pass" # respectively. This works with the GET method, too, but # I *STRONGLY* advise you not to use it. $login = anti_injection ( $_POST['user'], $_POST['pass'] ); # Verify the filtered user/pass combo... $conn = mysql_connect ( 'localhost', 'sql_user', 'sql_pass' ); $conn_db = mysql_select_db ( 'some_db', $conn ); $result = mysql_query ( "SELECT * FROM some_table WHERE user = '" . $login['user'] . "' AND pass = '" . $login['pass'] . "'" ); if ( mysql_num_rows ( $result ) > 0 ) { # Success! echo "Welcome!"; } else { # Humiliating defeat! echo "Bad credentials."; } ?>